Cisco ISE maillog

[Rene S.]

Hi, I found some strange entries in ISE's system logs, using this command: show logging system maillog.

Unfortunately  I wasn't able to find out what this means. Does anyone has an idea why this happens and which setting causes this? I see this entries for almost every hour.

2014-09-01T08:01:01.731301+02:00 ISE's HOSTNAME sendmail[791]: s81611u6000791: from=root, size=511, class=0, nrcpts=1, msgid=<201409010601.s81611u6000791@ISE's HOSTNAME>, relay=root@localhost

2014-09-01T08:01:01.739384+02:00 ISE's HOSTNAME sendmail[791]: s81611u6000791: to=root, ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30511, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused

Thanks!

KR

[Salma Sulthana]

Hi Renata,

Kindly check if the email configured to receive notifications from ISE is capable of receiving email notifications.

ISE should provide a global option to configure the source address for scheduled report notification emails.
When ISE is configured for an email notification to be sent when a scheduled report is generated, the source email address of the report notification mail is always "root@<ise_hostname>"

If the production email servers reject such source email address, you get these error logs.

However, you can create exceptions on the email server to allow the source address.

Regards

Salma

[Rene S.]

Hi Salma,

we get e-mail notifications from ISE all the time (but those are not scheduled reports, those are alarms). The mail address that I configured for ISE-alarm notifications is the one under Administration/System/Settings/Alarm Settings/Alarm Notification..

I cannot remember configuring scheduled reports.. also I cannot see any scheduled reports (see attachment)